What safeguards are in place to prevent card-skimming devices or other tampering?
Stripe card readers, like other modern payment terminals, employ several security measures to protect against skimmers. These include EMV chip technology, encryption, and secure communication protocols. Additionally, Stripe encourages the use of tap-to-pay (contactless) and mobile wallets, which offer enhanced security features.
Secure Connection: The reader uses Bluetooth Low Energy (LE) or USB to connect to the Stripe Terminal SDK, ensuring a secure communication channel.
Regular Updates: Stripe provides software updates for the reader to maintain security and comply with card network requirements.
Physical Security: The reader's design makes it difficult to tamper with or install skimming devices without visible evidence.
To further enhance security:
Regularly inspect the reader for any signs of tampering or attached devices.
Keep the reader's software up to date by allowing updates when prompted.
Ensure your staff is trained to handle the reader securely and recognize potential security threats.
Additionally, the Donorbox Live Kiosk app will not work if the card reader is disconnected from the tablet. The card reader itself is a dumb device, it needs to work in conjunction with an app. In our case, the app is connected to a Donorbox account, and that Donorbox account is connected to a Stripe account. Any man-in-the-middle would require a Stripe-enabled Donorbox account that also pays for the LK product, and they would have to get access to the app on the device, which is password protected.
If the tablet and card reader connects via Wi-Fi, how do we ensure they can’t be used as an entry point into the hospital’s broader network?
The tablets are password protected, meaning that someone would need to know the password of the tablet to get past the Donorbox Live Kiosk app. There are ways to segment your hospital Wi-Fi to ensure that these devices have their own network rather than being on your hospital's main network. This is not something that Donorbox would do.
The card readers do not have WiFi capability. They pair with the tablets via Bluetooth or a cable. There is no access into a Wi-Fi network from any card readers.
Could you outline the encryption and other controls used to protect donor information both in transit and at rest?
Data in Transit:
End-to-End Encryption (E2EE): Stripe Terminal encrypts sensitive card information from the moment it is presented to the card reader, transmitting it via E2EE to Stripe's secure servers.
TLS (Transport Layer Security): Stripe mandates the use of HTTPS for all its services, including communication between card readers and its servers, to ensure data is encrypted during transit. This prevents unauthorized individuals from intercepting or tampering with the data.
Tokenization: Stripe uses tokenization, which replaces sensitive card information with a unique identifier or "token". This token is used for processing transactions, eliminating the need to store sensitive card details on the merchant's servers, thereby reducing the risk of data breaches.
Secure API Integration: Stripe provides secure APIs and SDKs that enable businesses to integrate with their systems while maintaining secure data transmission.
Data at Rest:
Encryption at Rest: Stripe encrypts sensitive data, including card numbers, when it is stored on its servers. This ensures that even if the data is compromised, it remains unreadable to unauthorized individuals.
Card Data Vault (CDV): Stripe utilizes a dedicated infrastructure for storing, decrypting, and transmitting primary account numbers (PANs) like credit card numbers. This CDV operates in an isolated environment with restricted access to a limited number of specially trained engineers.
Separate Storage of Decryption Keys: Decryption keys for encrypted card numbers are stored on separate machines to prevent unauthorized access.
Compliance with PCI DSS: Stripe is a certified PCI Service Provider Level 1, the highest level of certification available. This ensures that they meet the stringent security standards outlined by the PCI DSS for handling and storing cardholder data.
Robust Access Controls: Stripe implements strict access controls to limit access to sensitive data to authorized personnel.
Continuous Monitoring and Auditing: Stripe continuously monitors its systems for suspicious activity and undergoes regular security audits to maintain a high level of security.
All of this information is directly from Stripe Security pages:
https://docs.stripe.com/security
https://stripe.com/legal/terminal-purchase
We also have a Trust Center that has all the information about Donorbox Security measures.
Related: Donorbox Live Kiosk FAQs